Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-111921 · Microsoft / collected KEV context

EUVD-2026-103289

GHSA-92qc-qm37-9wr9

GHSA-fmmf-xq98-g327

GO-2026-6730

cve-program · CVE-2026-111921

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fmmf-xq98-g327
• https://www.vulncheck.com/advisories/vikunja-0.13.0-before-2.7.0-incorrect-authorization-in-link-share-deletion

euvd · EUVD-2026-103289

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fmmf-xq98-g327
• https://www.vulncheck.com/advisories/vikunja-0.13.0-before-2.7.0-incorrect-authorization-in-link-share-deletion

nvd · CVE-2026-111921

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fmmf-xq98-g327
• https://www.vulncheck.com/advisories/vikunja-0.13.0-before-2.7.0-incorrect-authorization-in-link-share-deletion

osv · GHSA-fmmf-xq98-g327

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fmmf-xq98-g327
• https://github.com/go-vikunja/vikunja/commit/60e543777b4d3ec8376f5485911cdec697e8c8ee
• https://github.com/go-vikunja/vikunja
• https://github.com/go-vikunja/vikunja/releases/tag/v2.7.0

osv · GO-2026-6730

• https://github.com/go-vikunja/vikunja/security/advisories/GHSA-fmmf-xq98-g327

• Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check · Source adds a fixed version · 27 Oct 2026